October 20, 2026

HawkEye Lab: Investigating Keylogger Data Exfiltration with Network Forensics

Introduction

By Nada Alsaeed

2 min read

HawkEye Lab: Investigating Keylogger Data Exfiltration with Network Forensics

Cybersecurity investigations require a deep understanding of network traffic, attacker behavior, and digital evidence. In this article, I explore the objectives and investigation techniques involved in the HawkEye Lab on CyberDefenders, a Blue Team challenge focused on analyzing a HawkEye keylogger data exfiltration incident.

The lab focuses on network forensics, identifying Indicators of Compromise (IoCs), and investigating potentially stolen credentials using tools such as Wireshark and CyberChef.

Understanding the HawkEye Lab

HawkEye is associated with keylogging and information theft. A keylogger can capture keystrokes and potentially expose sensitive information, including usernames and passwords.

The objective of this lab is to reconstruct a suspected data exfiltration incident by examining network traffic and analyzing relevant artifacts.

This type of investigation helps security analysts understand how malicious software communicates with external infrastructure and how sensitive information may be transferred outside a compromised environment.

Tools Used in the Investigation

Several tools can support this investigation:

  1. Wireshark

Wireshark is a network protocol analyzer used to inspect packet captures, examine connections, identify suspicious traffic, and investigate communication between hosts.

  1. Brim

Brim supports the investigation of network activity through searchable network logs and structured traffic data.

  1. CyberChef

CyberChef helps analysts decode, transform, and analyze suspicious data that may appear encoded or obfuscated.

  1. VirusTotal

VirusTotal can help investigate suspicious files, hashes, domains, and IP addresses using available threat intelligence.

  1. MaxMind GeoIP

MaxMind GeoIP can provide approximate geographic information associated with an IP address, which may help add context to an investigation.

Investigation Methodology

A structured network forensics investigation generally follows these steps:

Step 1: Examine the Network Traffic

Open the provided packet capture in Wireshark and identify the communicating hosts, protocols, and unusual connections.

Step 2: Identify Suspicious Communications

Investigate unexpected outbound connections, repeated communication patterns, and potentially suspicious destinations.

Step 3: Investigate Potential Credential Theft

Review relevant traffic and available artifacts for evidence that sensitive information may have been exposed. Any conclusions should be supported by the actual lab evidence.

Step 4: Analyze Suspicious Data

If suspicious encoded data is discovered, CyberChef can help decode or transform it to make the content easier to examine.

Step 5: Identify Indicators of Compromise

Document relevant indicators, such as suspicious IP addresses, domains, file hashes, and communication patterns, when supported by the evidence.

Step 6: Reconstruct the Incident

Correlate the available findings to understand the potential sequence of events, from malicious activity to possible command-and-control communication and data exfiltration.

Mapping Findings to MITRE ATT&CK

The investigation can be connected to relevant MITRE ATT&CK tactics, depending on the evidence discovered.

  • Execution: Investigating evidence that malicious code was executed.
  • Credential Access: Examining evidence of attempts to obtain usernames and passwords.
  • Collection: Investigating whether sensitive information was gathered.
  • Command and Control: Analyzing communication between a potentially compromised system and external infrastructure.
  • Exfiltration: Investigating whether data was transferred outside the affected environment.

These are potential areas of investigation, not confirmed findings. Specific techniques should only be mapped when supported by evidence.

Key Lessons Learned

This lab highlights several important lessons for Blue Team analysts:

  • Network traffic can provide valuable evidence during incident response.
  • Wireshark is useful for examining suspicious connections and packet-level activity.
  • Threat intelligence tools can add context to suspicious indicators.
  • Encoded data may require additional analysis before its meaning becomes clear.
  • MITRE ATT&CK provides a structured way to document observed attacker behavior.
  • Conclusions should be based on verified evidence rather than assumptions.

Conclusion

The HawkEye Lab demonstrates the importance of network forensics when investigating suspected keylogger activity and data exfiltration.

By combining network analysis, data decoding, threat intelligence, and MITRE ATT&CK mapping, security analysts can build a clearer understanding of suspicious activity and strengthen their incident investigation skills.

Hands-on Blue Team challenges provide a valuable opportunity to practice analytical thinking and develop practical cybersecurity skills.

References

#CyberSecurity #BlueTeam #SOCAnalyst #NetworkForensics #MITREATTACK #CyberDefenders #IncidentResponse